[Sponsored] Learn how your app could evolve automatically, leaving reverse engineers behind with every release.

This week’s CloudPro has a bunch of things that made me pause and go, “Wait, that’s possible?”

📌A GitHub token leak that kicked off a supply chain attack targeting 100K+ repos

📌Git tools quietly leaking your credentials with just a newline

📌Kubernetes Ingress-NGINX bugs that might be hiding in your setup without you knowing

There’s also some great deep dives, like how Netflix handles 140 million hours of data every day, a homegrown Python bot that auto-heals K8s IP issues, and a hands-on post about cutting a $10K Glue bill down to $400 using Airflow.

Hope a few of these help you solve something annoying or spark a weekend project.

Cheers,

Shreyans Singh

Editor-in-Chief

Multiple Vulnerabilities Found in Kubernetes Ingress-NGINX

Several security flaws (CVEs) were found in the Kubernetes ingress-nginx controller. These issues do not affect Amazon EKS directly because EKS doesn’t include this controller by default. However, if customers manually installed it, they should update to the latest version. AWS has already alerted affected users.

How a Leaked GitHub Token Sparked a Widespread Supply Chain Attack Targeting Coinbase and 100,000+ Repos

Attackers pulled off a stealthy supply chain attack by leaking a GitHub token from a SpotBugs project, then using it to compromise other GitHub actions like reviewdog and tj-actions. They injected malicious code that silently spread through CI/CD workflows, eventually targeting Coinbase’s open-source project.

GitHub Finds Critical ruby-saml Flaws Letting Attackers Bypass SSO and Hijack Accounts

GitHub found two serious bugs in the ruby-saml library that let attackers bypass SAML authentication and potentially log in as any user. The problem came from how different XML parsers (REXML and Nokogiri) interpret the same data differently, letting attackers sneak in fake but valid-looking login info.

Git Tools Exposed: Bugs in GitHub Desktop, LFS, and CLI Let Attackers Steal User Credentials

A security researcher found that several Git-related tools, including GitHub Desktop, Git Credential Manager, Git LFS, and GitHub CLI, had flaws that let attackers trick them into leaking stored credentials (like tokens or passwords) to malicious servers. Most issues stemmed from how these tools handled special characters like carriage returns or newlines in URLs, causing credentials meant for GitHub to be sent elsewhere.

Microsoft Expands Security Copilot with AI Agents to Tackle Phishing, Insider Risks, and Shadow AI Threats

Microsoft has upgraded Security Copilot with AI agents that can now handle tasks like phishing detection, insider risk alerts, and vulnerability patching: automatically. These agents help security teams work faster and smarter, especially as cyberattacks become too complex and frequent for humans alone.

Build the knowledge base that will enable you to collaborate AI for years to come

💰 Competitive Pay Structure

⏰ Ultimate Flexibility

🚀 Technical Requirements (No AI Experience Needed)

Weekly payouts + remote work: The developer opportunity you've been waiting for!

The flexible tech side hustle paying up to $50/hour

AWS Launches Amazon Q Scenarios in QuickSight to Bring Forecasting and What-If Analysis to Everyone

AWS has launched the new "scenarios" feature in Amazon Q for QuickSight, letting users analyze data trends, forecast outcomes, and run what-if simulations, all through simple natural language. You don’t need to be a data expert or use spreadsheets anymore. This tool helps teams make smarter decisions faster.

How AWS Lambda Handles Billions of Async Requests Without Breaking a Sweat

When functions are called asynchronously, Lambda queues them, processes them later, and manages retries. For small apps, a single queue may be enough, but for massive scale, AWS uses smart techniques like consistent hashing and shuffle-sharding to separate workloads and reduce the risk of “noisy neighbors” affecting others.

AWS CodeBuild Adds Parallel Test Execution to Drastically Speed Up CI Pipelines

AWS just made it possible to run tests in parallel using CodeBuild, which means instead of testing code one piece at a time, you can test many pieces at once. This massively cuts down the time it takes for developers to know if their code works, making software updates much faster and less frustrating.

How I reduced $10000 monthly AWS Glue bill to $400 using Airflow

Akash and his team were spending $10,000/month running data pipelines on AWS Glue, but much of that cost came from paying for idle time. To fix it, they moved all those jobs to Apache Airflow running on EC2 and ECS, using Terraform to manage everything. It was tough—especially setting up workers, Redis, and autoscaling—but they pulled it off and slashed their bill to just $400/month.

How to run Firecracker without KVM on cloud VMs

Normally, to run lightweight virtual machines (like Firecracker microVMs), you need special hardware features (KVM) or expensive bare-metal cloud servers. But a new method called PVM (Pagetable Virtual Machine)—developed by Ant Group and Alibaba—lets you run Firecracker without KVM, even on cheaper cloud VMs that don’t support nested virtualization.

Kubernetes launches kube-scheduler-simulator

When Kubernetes decides where to run an app (called a Pod), it uses a complex component called the scheduler. But understanding why the scheduler makes certain decisions has always been hard. It’s like a black box. This new tool, kube-scheduler-simulator, opens up that black box. It lets you simulate a real cluster and see exactly how the scheduler makes its choices.

Kubernetes Launches JobSet to Simplify Large-Scale AI and HPC Workloads

As AI models get bigger, training them requires splitting the work across thousands of GPUs or TPUs spread over many servers. Kubernetes can help manage this, but its current tools aren't built to easily handle these complex, multi-part jobs. So, the Kubernetes team introduced JobSet, a new tool that makes it easier to run these distributed training jobs.

Kubernetes 1.32 Unlocks Smarter, Safer Linux Swap Support

Earlier, Kubernetes completely disabled swap because it couldn't track memory usage well when swap was involved. But now, after years of progress, Kubernetes 1.32 is finally adding proper support for Linux swap memory, which lets systems use disk space as extra RAM to avoid crashes during memory spikes.

How One Home Kubernetes User Beat ISP IP Changes with an Auto-Healing Python Bot

The author runs a home Kubernetes setup and relies on a dynamic IP address from their internet provider, which can unexpectedly change. Since IP changes can break things like firewall rules or service configurations, they built a Python program that constantly monitors their IPs. If the IP changes, it automatically updates firewall settings and Kubernetes resources to keep everything running smoothly.

Devtron + Argo CD: Enhancing GitOps without disruption

Teams are shipping code faster thanks to AI tools like GitHub Copilot, but their deployment systems, especially Argo CD, can’t keep up. Instead of replacing Argo CD, Devtron now integrates directly with it. This gives users more powerful deployment features like multi-cluster control, better security, and advanced rollout strategies, without breaking or migrating their existing setup.

Building a Searchable, Structured Logging System for Real-World Debugging

The author built a better logging system to help debug issues in a complex app. Instead of messy, inconsistent logs, they used structured logs that are easy to search, and even “canonical” logs that summarize everything about a request in one line. They sent these logs to tools like Loki and Clickhouse, so they could ask smart questions and actually learn from the data.

How Netflix stores 140 million hours of viewing data per day

Netflix collects an enormous amount of viewing data every day: from what you watch to when you pause. As this data exploded, their original system started to slow down. So they redesigned it: recent data is stored fast and uncompressed, older data is compressed and moved to long-term storage, and less important data (like short previews) is filtered out.

How to build the ultimate March Madness dashboard in Grafana

A techie March Madness fan built a real-time basketball tracking dashboard in Grafana that pulls live NCAA data, like scores and player stats, directly from public APIs. Using Grafana’s Infinity and Canvas plugins, they turned raw JSON into a jumbotron-style scoreboard that updates without refreshes.

📢 If your company is interested in reaching an audience of developers and, technical professionals, and decision makers, you may want toadvertise with us.

If you have any comments or feedback, just reply back to this email.

Thanks for reading and have a great day!